Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Output alert applayer v8.2 #9053

Closed
wants to merge 2 commits into from
Closed

Output alert applayer v8.2 #9053

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f74204
output/file: http2 metdata is logged in http object
catenacyber Jun 16, 2023
0bd8486
output/alert: rewrite code for app-layer properties
catenacyber May 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 0 additions & 89 deletions etc/schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1791,95 +1791,6 @@
},
"additionalProperties": false
},
"http2": {
"type": "object",
"properties": {
"http_method": {
"type": "string"
},
"http_user_agent": {
"type": "string"
},
"length": {
"type": "integer"
},
"status": {
"type": "integer"
},
"url": {
"type": "string"
},
"version": {
"type": "string"
},
"request_headers": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"table_size_update": {
"type": "integer"
},
"value": {
"type": "string"
}
},
"additionalProperties": false
}
},
"response_headers": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"table_size_update": {
"type": "integer"
},
"value": {
"type": "string"
}
},
"additionalProperties": false
}
},
"http2": {
"type": "object",
"properties": {
"stream_id": {
"type": "integer"
},
"request": {
"type": "object",
"properties": {
"priority": {
"type": "integer"
}
},
"additionalProperties": false
},
"response": {
"type": "object",
"properties": {
"error_code": {
"type": "string"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"ike": {
"type": "object",
"optional": true,
Expand Down
2 changes: 2 additions & 0 deletions rust/src/applayertemplate/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,14 @@ use crate::jsonbuilder::{JsonBuilder, JsonError};
use std;

fn log_template(tx: &TemplateTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("template")?;
if let Some(ref request) = tx.request {
js.set_string("request", request)?;
}
if let Some(ref response) = tx.response {
js.set_string("response", response)?;
}
js.close()?;
Ok(())
}

Expand Down
2 changes: 2 additions & 0 deletions rust/src/bittorrent_dht/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ fn print_ip_addr(addr: &[u8]) -> std::string::String {
fn log_bittorrent_dht(
tx: &BitTorrentDHTTransaction, js: &mut JsonBuilder,
) -> Result<(), JsonError> {
js.open_object("bittorrent_dht")?;
js.set_hex("transaction_id", &tx.transaction_id)?;
if let Some(client_version) = &tx.client_version {
js.set_hex("client_version", client_version)?;
Expand Down Expand Up @@ -125,6 +126,7 @@ fn log_bittorrent_dht(
}
js.close()?;
};
js.close()?;
Ok(())
}

Expand Down
5 changes: 3 additions & 2 deletions rust/src/http2/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@ fn log_http2_frames(frames: &[HTTP2Frame], js: &mut JsonBuilder) -> Result<bool,
}

fn log_http2(tx: &HTTP2Transaction, js: &mut JsonBuilder) -> Result<bool, JsonError> {
js.open_object("http")?;
js.set_string("version", "2")?;

let mut common: HashMap<HeaderName, &Vec<u8>> = HashMap::new();
Expand Down Expand Up @@ -261,8 +262,8 @@ fn log_http2(tx: &HTTP2Transaction, js: &mut JsonBuilder) -> Result<bool, JsonEr
let has_response = log_http2_frames(&tx.frames_tc, js)?;
js.close()?;

// Close http2.
js.close()?;
js.close()?; // http2
js.close()?; // http

return Ok(has_request || has_response || has_headers);
}
Expand Down
4 changes: 2 additions & 2 deletions rust/src/quic/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ fn quic_tls_extension_name(e: u16) -> Option<String> {
}
}

fn log_template(tx: &QuicTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
fn log_quic(tx: &QuicTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("quic")?;
if tx.header.ty != QuicType::Short {
js.set_string("version", String::from(tx.header.version).as_str())?;
Expand Down Expand Up @@ -153,5 +153,5 @@ pub unsafe extern "C" fn rs_quic_to_json(
tx: *mut std::os::raw::c_void, js: &mut JsonBuilder,
) -> bool {
let tx = cast_pointer!(tx, QuicTransaction);
log_template(tx, js).is_ok()
log_quic(tx, js).is_ok()
}
4 changes: 3 additions & 1 deletion rust/src/snmp/log.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ fn str_of_pdu_type(t:&PduType) -> Cow<str> {

fn snmp_log_response(jsb: &mut JsonBuilder, tx: &mut SNMPTransaction) -> Result<(), JsonError>
{
jsb.open_object("snmp")?;
jsb.set_uint("version", tx.version as u64)?;
if tx.encrypted {
jsb.set_string("pdu_type", "encrypted")?;
Expand Down Expand Up @@ -71,11 +72,12 @@ fn snmp_log_response(jsb: &mut JsonBuilder, tx: &mut SNMPTransaction) -> Result<
}
}

jsb.close()?;
return Ok(());
}

#[no_mangle]
pub extern "C" fn rs_snmp_log_json_response(jsb: &mut JsonBuilder, tx: &mut SNMPTransaction) -> bool
pub extern "C" fn rs_snmp_log_json_response(tx: &mut SNMPTransaction, jsb: &mut JsonBuilder) -> bool
{
snmp_log_response(jsb, tx).is_ok()
}
2 changes: 2 additions & 0 deletions rust/src/ssh/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ use super::ssh::SSHTransaction;
use crate::jsonbuilder::{JsonBuilder, JsonError};

fn log_ssh(tx: &SSHTransaction, js: &mut JsonBuilder) -> Result<bool, JsonError> {
js.open_object("ssh")?;
if tx.cli_hdr.protover.is_empty() && tx.srv_hdr.protover.is_empty() {
return Ok(false);
}
Expand Down Expand Up @@ -58,6 +59,7 @@ fn log_ssh(tx: &SSHTransaction, js: &mut JsonBuilder) -> Result<bool, JsonError>
}
js.close()?;
}
js.close()?;
return Ok(true);
}

Expand Down
4 changes: 4 additions & 0 deletions scripts/setup-app-layer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,10 @@ def logger_patch_output_c(proto):
output = io.StringIO()
inlines = open(filename).readlines()
for i, line in enumerate(inlines):
if line.find("ALPROTO_TEMPLATE") > -1:
new_line = line.replace("TEMPLATE", proto.upper()).replace(
"template", proto.lower())
output.write(new_line)
if line.find("output-json-template.h") > -1:
output.write(line.replace("template", proto.lower()))
if line.find("/* Template JSON logger.") > -1:
Expand Down
11 changes: 5 additions & 6 deletions src/app-layer-ftp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1407,13 +1407,10 @@ uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
return c == NULL ? len : (uint16_t)(c - buffer + 1);
}

void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb)
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
{
const FtpDataState *ftp_state = NULL;
if (f->alstate == NULL)
return;

ftp_state = (FtpDataState *)f->alstate;
const FtpDataState *ftp_state = (FtpDataState *)vtx;
jb_open_object(jb, "ftp_data");

if (ftp_state->file_name) {
jb_set_string_from_bytes(jb, "filename", ftp_state->file_name, ftp_state->file_len);
Expand All @@ -1428,6 +1425,8 @@ void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb)
default:
break;
}
jb_close(jb);
return true;
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/app-layer-ftp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ uint64_t FTPMemuseGlobalCounter(void);
uint64_t FTPMemcapGlobalCounter(void);

uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb);
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb);

#endif /* __APP_LAYER_FTP_H__ */

Loading